Comp keeps restarting (RPC problem)

karatekidkaratekid Ogdensburg, NY
edited August 2003 in Science & Tech
Aggg, my head hurts. Anyway, this problem has started in just the past 4 hours. The computer will seem to be working happily when suddenly I will be told that my system will reboot, and that the reboot has been caused by Remote Procedure Call. I don't know what could be causing this problem as I have not changed anything to my system in weeks. The reboots happen randomly, though in the past hour they have picked up in frequecny to the point where I can only use the computer for a minute or two. Also, the computer does not seem to care what I am doing at the time, as this has happened while playing games, surfing the web, and just sitting there (with and with out folding on.)

I have Windows XP Pro SP1 installed on a Athlon XP 2100+ on a KX7-333R. Everything is at stock speed. I have never incountered this problem before so I really don't have the slightlest idea of what to do. I don't want to resort to reinstalling Windows. Can somebody help me? Pretty please?

Comments

  • Loki047Loki047
    edited August 2003
    I have the same problem on 2 comps with XP pRo, im wondering if its something to do with them possibly being cracked.... Thats the only thing i can think off
  • imported_Souriatimported_Souriat
    edited August 2003
    http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

    Install this patch and everything should stop :)
  • BikrBikr Teh Florida New
    edited August 2003
    don't do the patch yet.. !!!! i'm writing a longer reply , hold on
  • BikrBikr Teh Florida New
    edited August 2003
    Ok.. Don't do that patch yet.. here is how you fix the problem.. Goto start run and type services.msc once that is open find the RPC service and right click on it goto properties.. in the recovary tab are 3 things , make sure they all say "take no action" then apply and then apply the patch..

    This is the best route to fixing this issue.. --Josh
  • BlackHawkBlackHawk
    hasn't had the problem yet :)
     Bible music connoisseur There's no place like 127.0.0.1 Icrontian
    edited August 2003
    hasn't had the problem yet :)
  • BikrBikr Teh Florida New
    edited August 2003
    <--i haven't either.. but helped a few people out ;) you know who you are..
  • Loki047Loki047
    edited August 2003
    what kind of bug is that... It completely destroys the usefulness of a system... Dang Microsoft.
  • BikrBikr Teh Florida New
    edited August 2003
    it works by sending a malformed message through rpc the message causes a buffer overflow and ends up shutting down svchost. the system then panics and looks to see how to deal with it. if your system is setup to deal with it by rebooting , then that's what it does.. --Bikr
  • BlackHawkBlackHawk Bible music connoisseur There's no place like 127.0.0.1 Icrontian
    edited August 2003
    http://www.eweek.com/article2/0,3959,1208670,00.asp
  • karatekidkaratekid Ogdensburg, NY
    edited August 2003
    Thanks for the help guys. The RPC problem is over, but I have new problems :( (ugg, this will never end.) The the comp is moving incredably slow, and it seems that no video or sound drivers are installed. Whats worse though is that I can't seem to install drivers. Installation seems to work fine, but after restarting my computer I find that the drivers didn't actually install ;[.
  • karatekidkaratekid Ogdensburg, NY
    edited August 2003
    Bikr, I have to ask what is the reason for changing the recovery options for the RPC before applying the patch? As I understand it the patch fixes the vulnerability in the DCOM so that it does not crash when it receives a bad massage. Are there other vulnerabilities in the RPC that this patch does not fix?
  • BikrBikr Teh Florida New
    edited August 2003
    yes, the patch does not fix the DoS attack on the port. They can still execute commands by dos'ng the service.. As far as your driver problems go , that is really odd.. this just happened after the last reboot? --Josh
  • BlackHawkBlackHawk Bible music connoisseur There's no place like 127.0.0.1 Icrontian
    edited August 2003
    Originally posted by karatekid
    Thanks for the help guys. The RPC problem is over, but I have new problems :( (ugg, this will never end.) The the comp is moving incredably slow, and it seems that no video or sound drivers are installed. Whats worse though is that I can't seem to install drivers. Installation seems to work fine, but after restarting my computer I find that the drivers didn't actually install ;[.
    Format C: /q /u ;)
  • stoopidstoopid Albany, NY New
    edited August 2003
    Originally posted by Black Hawk
    Format C: /q /u ;)

    That's your answer to everything :rolleyes:


    :p
  • BikrBikr Teh Florida New
    edited August 2003
    You could do an xp/nt repair install.. Other than that , format might be your only choice. --Josh
  • Cool-CanuckCool-Canuck
    edited August 2003
    http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
    Seems to be hitting everyone.
  • stoopidstoopid Albany, NY New
    edited August 2003
    Originally posted by Cool Canuck
    http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
    Seems to be hitting everyone.

    Company I work for is in the process of patching over 100 production and development servers... in the middle of the day! :p

    Needless to say, if we got hit (which we have, confirmed even how it got in through a subsidiary), others are getting their butts handed to them. lol
  • BikrBikr Teh Florida New
    edited August 2003
    Yah.. Gnome posted on addaboy that I may have gotten hit , but I didn't think I did , the worm seems to check ips to see if they are patched , or vulnerable , then it will DoS the port if it can't just use the exploit.

    This was what happened to me , a full range of ips began DoS'ng my 135 , thinking I was patched <--which I wasn't , My router fooled the box. My linksys shut itself down as a fail safe to the attack.

    So in essence They did take me down , but my system was in no way comprimised =) Now to yell at Linksys for their router crapping out hehe --Josh
  • bluntblunt
    edited August 2003
    i got this problem, but i got it fixed
  • BikrBikr Teh Florida New
    edited August 2003
    *cough* post whore *cough*

    Anyway.. I've been doing some reading, this is pretty ingenious stuff.. I"m not gonna post any links , but do some searches and read up , it's really good reading material.. --Josh
  • karatekidkaratekid Ogdensburg, NY
    edited August 2003
    Boy, has this been an adventure. Even before seeing Blackhawk's post I had decided to format and reinstall Windows. So I do a quick NTFS format and install XP, but about 2/3 of the way though I get a COM+ error. I let the installation complete and was greeted with a desktop but no taskbar or start menu. After rebooting a couple of times I reinstalled again, same error, same results. Finally I reinstalled and did a full NTFS format, and unpluged my flash card reader. One of those two did it (I am more inclinded to think it was unplugging the flash card reader.)

    I don't know if anybody noticed, but I took all the information I have found about this problem, and bikr's solutions, and wrote a quick FAQ about this (last night while my comp was super laggy :D). If you want you can read it <A HREF="http://www.icrontic.com/index.php?module=faq&&id=1890&quot; target=_blank>here</A>.
  • BikrBikr Teh Florida New
    edited August 2003
    thanks for the props ;)
  • PoofacePooface
    edited August 2003
    how can u tell if ips r dosing port 135? i also have a linksys router.
  • BikrBikr Teh Florida New
    edited August 2003
    firewall , if you dont' want to play with your router , just port redirect all incoming 135's to your pc and install tiny personal firewall or zone alarm , and make sure port 135 is set to monitor. you'll see the hits and it'll block them it'll also give you ips , but most likely it's the worm hitting you and not a person.

    So retailiating is not a good idea.. =) --Bikr
Sign In or Register to comment.